Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2023 09:41
Static task
static1
Behavioral task
behavioral1
Sample
6cec8e58bbf6ebe3e4a3baa2310307930d5a84839a0edbdb630aef6c1fddc9f6xls_JC.xls
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6cec8e58bbf6ebe3e4a3baa2310307930d5a84839a0edbdb630aef6c1fddc9f6xls_JC.xls
Resource
win10v2004-20230703-en
General
-
Target
6cec8e58bbf6ebe3e4a3baa2310307930d5a84839a0edbdb630aef6c1fddc9f6xls_JC.xls
-
Size
1.6MB
-
MD5
d1a5f0d011f958e14d46dbf301707a15
-
SHA1
03a175fe4db4f4fcaee3899f0f0e4c0e71a5ccda
-
SHA256
6cec8e58bbf6ebe3e4a3baa2310307930d5a84839a0edbdb630aef6c1fddc9f6
-
SHA512
87c33f02f35bf4679695e0473ad48c4c9674f3c548c065ee1c1f4d862ec195e4ffce3ae8d9eff3258367b88f492d8cddb7f7ef661c05a3469a9ad0771c9057fc
-
SSDEEP
49152:OQmmQ30mupF6VUQmmQ3030V6VXiNhv3t3bXXm7PuaMo0:OpmQkmmmUpmQk3cmXMhhX/a
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2120 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2120 EXCEL.EXE 2120 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6cec8e58bbf6ebe3e4a3baa2310307930d5a84839a0edbdb630aef6c1fddc9f6xls_JC.xls"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2120
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5a01b9617553432807b9b58025b338d97
SHA1439bdcc450408b9735b2428c2d53d2e6977fa58c
SHA2567a0426ed2e2349916969ff7087c0f76089fb8ce7f4627f3d11ccbc1aaefcedce
SHA512312cc2563fa865d6a939fea85a520627c73ed9a95bafc98c89495f21d535dc658825be74b64f0f5c5815d1d234fc6e77a71779247e4973e39ba8dccec2f09bee